Risk Analysis and Control for Industrial Processes - Gas, Oil and Chemicals: A System Perspective for Assessing and Avoiding Low-Probability, High-Consequence Events

By Hans J Pasman

Risk Analysis and Control for Industrial Processes - Gas, Oil and Chemicals provides an analysis of current approaches for preventing disasters, and gives readers an overview on which methods to adopt.

The book covers safety regulations, history and trends, industrial disasters, safety problems, safety tools, and capital and operational costs versus the benefits of safety, all supporting project decision processes. 

Tools covered include present day array of risk assessment, tools including HAZOP, LOPA and ORA, but also new approaches such as System-Theoretic Process Analysis (STPA), Blended HAZID, applications of Bayesian data analytics, Bayesian networks, and others. The text is supported by valuable examples to help the reader achieve a greater understanding on how to perform safety analysis, identify potential issues, and predict the likelihood they may appear.

• Presents new methods on how to identify hazards of low probability/high consequence events
• Contains information on how to develop and install safeguards against such events, with guidance on how to quantify risk and its uncertainty, and how to make economic and societal decisions about risk
• Demonstrates key concepts through the use of examples and relevant case studies

• Language: English
• Publisher: Elsevier Science
• Release date: Jun 14, 2015
• ISBN: 9780128009123

Hans J Pasman

TEES Research Professor, Mary Kay O'Connor Process Safety Center, Texas A&M University, Texas, USA., Emeritus Professor, Chemical Risk Management of the Delft University of Technology, and associated member of the Dutch Council for Life Environment and Infrastructure in the Netherlands. Professor Pasman graduated in Chemical Technology at Delft University of Technology in 1961, and finished a Doctor’s thesis in 1964 while working for Shell. He joined the Dutch Organisation for Applied Research, TNO, in 1965, initiating and performing research in reactive materials, gas, dust and energetic material explosions, investigation of industrial accidents and risk analysis, while also managing organizational units. He has been a member of the Working Party on Loss Prevention and Safety Promotion in the Process Industries since 1972, and chairman from 1986-2004. In this latter capacity he was instrumental in founding the European Process Safety Centre in 1992. He has also been chairman of the International Group on Unstable Substances (IGUS) for 10 years, of the European Study Group on Risk Analysis (1980-1985), and of a NATO Group on Explosives (1982-1992). At the Delft University of Technology he led a multinational project on gas explosion fundamentals at elevated pressures and temperatures (2003-2008). In 2007 he co-organized a NATO advanced research workshop on Resilience of Cities to Terrorists and other Threats. From 2004-2012 he was a Member of the Dutch national Advisory Council on Hazardous Substances.

Book preview

Risk Analysis and Control for Industrial Processes - Gas, Oil and Chemicals

A System Perspective for Assessing and Avoiding Low-Probability, High-Consequence Events

Hans Pasman

Table of Contents

Cover image

Title page

Copyright

Foreword

Preface

Acknowledgments

Chapter 1. Industrial Processing Systems, Their Products and Hazards

Introductory remarks

1.1. General global outlook

1.2. Ammonium nitrate

1.3. Ammonia

1.4. Petrochemicals

1.5. Gasoline

1.6. Natural gas

1.7. Liquefied petroleum gas

1.8. Hydrogen

1.9. Dust explosions

1.10. Runaway reactions

1.11. Hazardous material spills in transportation accidents

1.12. Conclusion

Chapter 2. Regulation to Safeguard against High-Consequence Industrial Events

Summary

2.1. Some historical landmarks of main themes of regulation in the United States and European Union

2.2. Stationary source siting (US) or land use planning (EU)

2.3. Protection of workers and the public in the United States

2.4. European Union Directives and transposition in national law

2.5. Offshore and gas safety

2.6. Transport of hazardous materials

2.7. GHS, Globally Harmonized System of Classification and Labeling of Chemicals

2.8. Future directions

2.9. Conclusion

Chapter 3. Loss Prevention History and Developed Methods and Tools

Summary

3.1. Brief history/evolution of loss prevention and process safety

3.2. Organization, leadership, management, safety management system, culture

3.3. Hazards, danger, safety, and risk

3.4. Accident investigation tools

3.5. Knowledge and tools: hazardous substance properties, system safety, process technology

3.6. Risk analysis tools, risk assessment

3.7. Evaluation of the state of risk analysis methodology

3.8. Conclusions

Chapter 4. Trends in Society and Characteristics of Recent Industrial Disasters

Summary

4.1. Business, industry, and energy trends

4.2. Societal trends

4.3. Two example accidents analyzed

4.4. Conclusions

Chapter 5. Sociotechnical Systems, System Safety, Resilience Engineering, and Deeper Accident Analysis

Summary

5.1. Sociotechnical systems and safety

5.2. System approach to risk control

5.3. Resilience engineering of sociotechnical systems

5.4. Conclusions

Chapter 6. Human Factors, Safety Culture, Management Influences, Pressures, and More

Summary

6.1. Human factors and occupational safety and health

6.2. Occupational risk modeling

6.3. Methods to assess human error, or rather human reliability

6.4. Human mechanisms for decision making and the ETTO principle

6.5. Safety culture, safety climate, safety attitude

6.6. Organizational hierarchy, management dilemmas and rules

6.7. Process safety performance indicators

6.8. Conclusions

Chapter 7. New and Improved Process and Plant Risk and Resilience Analysis Tools

Summary

7.1. Introduction

7.2. System-theoretic process analysis

7.3. Blended Hazid: HAZOP and FMEA in a system approach

7.4. Innovation and extension of classical risk assessment methods

7.5. Bayesian statistics and BNs

7.6. Uncertainty, fuzzy sets

7.7. Some applications of BN

7.8. Merging technical and human factor: agent-based modeling and Petri nets

7.9. Resilience engineering

7.10. Conclusions

Chapter 8. Extended Process Control, Operator Situation Awareness, Alarm Management

Summary

8.1. Problem analysis

8.2. Developments in control theory

8.3. Fault detection and diagnosis and fault-tolerant control

8.4. Trends in SCADA system infrastructure

8.5. Human factors in control, control room design, alarm management

8.6. Start-up, shut-down, and turn-around

8.7. Conclusions

Chapter 9. Costs of Accidents, Costs of Safety, Risk-Based Economic Decision Making: Risk Management

Summary

9.1. Costs of accidents

9.2. Costs of safety

9.3. Risk-based decision making

9.4. Safety risk management in context

9.5. Conclusions

Chapter 10. Goal-oriented versus Prescriptive Regulation

Summary

10.1. Background and literature sources

10.2. Discussion

10.3. Conclusion

Chapter 11. The Important Role of Knowledge and Learning

Summary

11.1. The need for structured knowledge

11.2. Knowledge sources and research

11.3. Knowledge management

11.4. Safety education and training

11.5. Conclusion

Chapter 12. Risk, Risk Perception, Risk Communication, Risk Acceptance: Risk Governance

Summary

12.1. Introduction, risk as concept, and rare events

12.2. Risk perception and risk communication

12.3. Public decision making, stakeholder participation

12.4. Risk management, risk acceptance criteria, ALARP

12.5. Conclusion

Chapter 13. Conclusions: The Way Ahead

Index

Copyright

Butterworth Heinemann is an imprint of Elsevier

The Boulevard, Langford Lane, Kidlington, Oxford OX5 1GB, UK

225 Wyman Street, Waltham, MA 02451, USA

Copyright © 2015 Elsevier Inc. All rights reserved.

This book and the individual contributions contained in it are protected under copyright by the Publisher (other than as may be noted herein).

No part of this publication may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying, recording, or any information storage and retrieval system, without permission in writing from the publisher. Details on how to seek permission, further information about the Publisher’s permissions policies and our arrangements with organizations such as the Copyright Clearance Center and the Copyright Licensing Agency, can be found at our website: www.elsevier.com/permissions.

Notices

Knowledge and best practice in this field are constantly changing. As new research and experience broaden our understanding, changes in research methods, professional practices, or medical treatment may become necessary.

Practitioners and researchers must always rely on their own experience and knowledge in evaluating and using any information, methods, compounds, or experiments described herein. In using such information or methods they should be mindful of their own safety and the safety of others, including parties for whom they have a professional responsibility.

To the fullest extent of the law, neither the Publisher nor the authors, contributors, or editors, assume any liability for any injury and/or damage to persons or property as a matter of products liability, negligence or otherwise, or from any use or operation of any methods, products, instructions, or ideas contained in the material herein.

Library of Congress Cataloging-in-Publication Data

A catalog record for this book is available from the Library of Congress

British Library Cataloguing-in-Publication Data

A catalogue record for this book is available from the British Library

ISBN: 978-0-12-800057-1

For information on all Butterworth Heinemann publications visit our website at http://store.elsevier.com/

Publisher: Jonathan Simpson

Acquisition Editor: Fiona Geraghty

Editorial Project Manager: Cari Owen

Production Project Manager: Debbie Clark

Typeset by TNQ Books and Journals

www.tnq.co.in

Printed and bound in the United States of America

Foreword

At the outset, I must say that this volume by Professor Hans Pasman on Risk Analysis and Control for Industrial Processes, A System Perspective for Assessing and Avoiding Low Probability, High Consequence Events, is a very timely and much needed treatise. It is even more important given the need for process safety and sustainable development, and the need for a rational and constructive approach to risk assessment, risk management, and control against the backdrop of globalization.

Professor Pasman has been a visionary and trailblazer in the development and application of new methods and approaches in various areas of process safety and risk assessment. Over more than two decades of our professional association and friendship, I have always been impressed by his clarity of thought and great depth of expertise. This book is another indicator of Professor Pasman's stellar contributions to the theory and practice of the diverse and complex field of risk assessment.

The hunger for energy and the need for chemical products continue to fuel the growth of the chemical and petrochemical industries. Consequently, the risks and the hazards associated with the growth continue, and the challenges posed by technology, scale, and intensity of operations grows and changes. With the increasing complexity of chemical processes, interdependent chemical infrastructure, and the need for considering diverse issues such as safety, environment, cost, and social and cultural factors, challenges to process safety and risk assessment can no longer be solved by simple approaches. Process safety is at a crossroads with systems engineering, complex systems, and engineering for sustainable development. Assessments needed to address process safety challenges most often span a complex system requiring the application of sophisticated systems analysis. A complex systems approach allows the study of parts of a system that taken together cause the whole system to behave in a certain manner and how that behavior interacts with its environment.

Process safety is very closely linked to sustainable development. Risk assessments in the twenty-first century must bring together elements of manufacturing, design, and sustainable engineering in an integrated form. Interwoven through this new paradigm is the consideration of risk in every aspect. Another important aspect of risk assessments is the ability to deal with low probability–high consequence events.

Professor Pasman has been successful in taking a refreshing and poignant look at process safety and risk management; he has applied a systems approach in a holistic manner for the analysis and control of risks inherent to the operations of the processing industry and their products. He addresses risks in the chemical industry, processing of energy carriers such as oil and gas, metal and food processing, and storage and transportation of hazardous materials. The book also provides a very comprehensive review of methods used over the years to understand and manage risks. I sincerely believe that the book has opened up a new vista and perspective on methodological improvements, necessary in the ever-increasing complexity of safe manufacturing and distribution in a competitive world.

M. Sam Mannan,     Regents Professor and Director, Mary Kay O'Connor Process Safety Center, Texas A&M University, College Station, Texas, USA

Preface

Meanwhile, when the sun rises, the fog will not be harmful,

—free translation of Daniel Chodowiecki's explanation of his etching symbolizing the Enlightenment (1791)

Scope, motivation, objectives, and contents of the book

The existence of mankind on this world in the present magnitude and growth and at a reasonable level of comfort is only physically possible thanks to the process industry providing us energy and fuels, construction and electronic materials, fertilizers and food, textiles, pharmaceuticals, coatings, drinking water, and so forth. This dependence will further grow, certainly when the standard of living in the developing countries reaches that of developed ones. However, industrialization comes with certain risks. Most dreadful are risks of high consequence, low probability events involving hazardous materials, which can be widely ranging in nature and effect. Many examples of major accident hazards have already been observed. High consequence means catastrophic losses, sometimes with huge loss of human life including various kinds of other harm, and losses to the means, infrastructures, and environments on which our lives depend. The human body is rather vulnerable to mechanical impact and shock, extreme temperatures, and a long list of gaseous, liquid, and solid substances that over certain concentration thresholds are lethally toxic to our system. We do not need to mention high intensities or doses of heat, nuclear, and electro-magnetic radiation. Walking into an enclosure with low oxygen concentration in the air is not healthy as well and may cause acute death. On the other hand, low probability of occurrence is very low. Indeed, the considered event may not happen in our lifetime. Measured in a probability over a certain time duration the event may be not less frequent than the impact of a comet, but this does not mean it cannot show up; it still can happen tomorrow! Yet if its precursor trail is detected, we gain the opportunity to influence and reduce its probability of occurrence.

Risk analysis as an approach and collection of methods to foster safe ways of achieving production goals has developed since the 1960s. It has roots in the nuclear power community of academia, regulators, and industry and has spread to various engineering disciplines and beyond to management, medicine, economy, and finance. Basically, nuclear power risk analysts founded the leading forum of Probabilistic Safety Assessment and Management conferences operating since the early 1990s. Even more general and perhaps less technical oriented are the aims of the Society for Risk Analysis, which is active in organizing meetings in various parts of the world. Risk management practice applying the methods of risk analysis became a must in the many aspects of business life and finance, and even further evolved to risk governance of company boards and governments.

The process industry, though, in its early development was plagued by mishaps from sometimes unknown chemical and physical mechanisms, and it was keen to establish safe approaches. Beginning in the 1960s under the auspices of chemical engineering institutions, loss prevention symposia have been organized in the United States and Europe, and some years later in Asia. These symposia have been instrumental in developing concepts and methods for hazard and risk analysis, and know-how for optimal organization and safety management, while adopting elements from elsewhere. They still give much attention to sharing knowledge on material properties, damaging mechanisms due to spills and unintentional releases, and preventive and protective measures.

This book endeavors to address all those leading or being employed in the industry and those involved in care for safety of the industry who prefer an overview and to see a timeline of developments. The book is intended especially to address students, in particular engineers, and to challenge them to advance the field further. Hopefully, the overview it offers will also be consulted by policy and decision makers, as it shows in risk prediction the strengths and weaknesses of science and engineering. For those who are less technically interested, each chapter is preceded by a summary.

The book is meant as a contribution to enhance process safety and risk and uncertainty management; it tries to apply a system approach and to cover in a holistic way the analysis and control of risks inherent to the operations of the processing industry and their products. It therefore focuses on the chemical industry, processing of energy carriers such as oil and gas, metal and foodstuff processing, and storage and transportation of hazardous materials. It briefly reviews experiences collected over the years and existing methods to understand and manage risks. The main aim is, however, to open a further future perspective of methodological improvements, necessary in the ever-increasing complexity of getting products safely manufactured and distributed in a competitive world. Knowledge of the human factor, organizational and technical aspects shall be merged and interaction in a sociotechnical system must be analyzed for improved risk control to avert mishaps.

Necessarily, the book has its limits. It does not provide a complete detailed overview of all that has been written about the subject in a technical sense as that is the objective of Lees' Loss Prevention in the Process Industries, not even in a condensed way as in Lees' Process Safety Essentials. The latter book is certainly very useful for those who want to know more on certain aspects. But, this book selects and briefly summarizes knowledge on major hazards and acute effects in a balanced way on all those aspects that are of significance for fostering process and plant safety. This approach is followed with regard to both technical and organizational aspects, including regulatory and human factor ones. All relevant aspects of which the author is aware of are touched upon with some references for those who desire further details. The book is in part established material, yet delves into new developments and methods up until the end of 2014 with a promise for improved future risk control. With regard to examples and regulatory aspects, most of what is discussed already occurs in or is applicable to the United States and Europe. The issue of security is only mentioned in a few instances because many generic aspects of it are covered by process safety and risk reduction measures. Unfortunately, we must live with many acronyms. These have been noted and defined repeatedly; I hope this is helpful but not irritating.

The process safety building has many doors and rooms filled with experience, system engineering, risk assessment, management, and human factors. I have tried to connect the rooms, because so far the field consists largely of a collection of specialties.

Hans J. Pasman

Acknowledgments

Thoughts about what shall be written and how to write them need reaction from colleagues with critical minds. I was fortunate to find friends who did not necessarily agree with what I had drafted. The text with an initial Dutch flavor was first Americanized and then converted to English–English but kept in American spelling. Meanwhile, comments were made and suggestions given with regard to the content, improving its quality.

Firstly, I would like to acknowledge the invaluable support of Dr William (Bill) J. Rogers, who teaches risk management and probabilistic methodology at the Mary Kay O'Connor Process Safety Center (MKOPSC) of the Artie McFerrin Chemical Engineering Department of Texas A&M University, College Station, Texas. Bill was inspiratory, a theory provider, and supporter in systems approach to process safety and predictive risk analysis. Dealing with uncertainty is key in this problem field. I enjoyed the many discussions (and also the concerts he organized). Secondly, Dr Simon P. Waldram of Waldram Consultants Ltd, also a research fellow at MKOPSC, formerly a professor at the University of London, was my chemical-physical conscience. Apart from making critical comments, he also gave the text a true English touch. Dr Paul H. J. J. Swuste, associate professor of the Safety Science Group of the Delft University of Technology, the Netherlands, with a background in biochemistry but extensive experience in occupational safety and safety management, supported me in the long-term main lines of safety thinking and kept me straight in the human factor and organizational aspects. Further, thanks to Ms. Trish Kerin, BEng, Director IChemE Safety Center, Institution of Chemical Engineers, in Melbourne, who after her industrial experience made very useful practical comments on the manuscript.

In addition, I would like to thank Dr M. Sam Mannan, PE, CSP, DHC, Director of MKOPSC and Regents Professor at Texas A&M University, for his moral support and Dr Sonny Sachdeva and Joshua Richardson of MKOPSC who managed and obtained the copyright permissions.

Lastly, I want to thank my wife, Ina, my partner in life, who has steadfastly stuck by my side, as well as my children and grandkids who missed seeing opa for quite some periods.

I graduated in chemical technology and started my career at Shell, but during military service was transferred to TNO, the Dutch National Research organization. Apart from defense research, I necessarily learned much about process safety by investigating numerous disastrous accidents in the late 1960s and early 1970s by directing development of experimental methods and performance of risky experiments of various kinds to explain what happened in these accidents. I have been a member and then 10  years chairman of the European (EFCE) Working Party on Loss Prevention since its beginning in 1972, as well as helped to found the European Process Safety Centre. As well, I thank all my former colleagues at TNO, at the Delft University of Technology where I have been teaching chemical risk management, and of the Working Party for their cooperation and support. Although we have now a wealth of computational models providing the basis of system risk analysis, it is unfortunate that young generations can only obtain limited (but safe!) experimental experience, both in the chemical and physical senses but also in human and organizational functioning. Experimenting is expensive and models are a way of studying a problem. But, a model remains only a model that must be tested, and the mechanisms threatening process safety are complex and vary widely. The looming mishap is always hidden in the tails of the distributions.

Finally, I would like to admit that if Ms. Fiona Geraghty of Elsevier had not challenged me, I would never have started writing this book. My hope is that it will contribute to a sound understanding of how to manage industrial process risks.

Hans J. Pasman

Chapter 1

Industrial Processing Systems, Their Products and Hazards

Abstract

Major risks posed by process industry are caused by different types of hazard potential. High-consequence risk means that the hazard will have impact over a substantial distance from a source. Possible effects on people and the environment can be by fire, blast, fragments, and also by spread of toxic materials. As an introduction to the next chapters, accident events are described with common substances such as ammonium-nitrate fertilizer, gasoline, and liquefied petroleum gas. Also, dust explosions, reactor runaway in synthesis processes of, for example, pharmaceuticals, and transportation accidents with hazardous materials and pipelines are described. These substances are needed to energize our mobility and to provide for our foodstuffs, clothing, and construction. Although ways were found to produce and handle them relatively safely, we should do better. For this, it is imperative that predictive risk analysis is performed and risks reduced to an adequate level.

Keywords

BLEVE; Detonation; Hazard potential; Hazardous materials; Hazardous substance properties; Industrial process accidents; Risk; Runaway; Transportation risks; Vapor cloud explosion

Accidents will happen, but forewarned is forearmed.

Eighteenth-century English proverb

Introductory remarks

Dealing with high-consequence, low-probability process industry risk sources, exposing their immediate environment to major hazards and acute effects, ought to start with discussing the dreadful tragedy caused by an accident in the Union Carbide plant in Bhopal, India, in 1984. It is certainly not the purpose here to describe this catastrophe in any detail, but this largest of all industrial disasters shall be mentioned. A toxic cloud of methyl-isocyanate escaped from a storage tank after it was heated up in a decomposition reaction with clean water (a so-called runaway reaction). The water entered the tank by accident. Due to the low wind speed and relatively cool night conditions, the growing cloud stayed low near the ground while slowly drifting from the plant to an adjacent neighborhood of migrant makeshift housing in which many slept. The cloud caused thousands of fatalities and many more suffered from toxic effects, some of which continue to this day. For complete details of this accident, see Lees' Loss Prevention in the Process Industries¹ or books especially about the case such as by Shrivastava² or Pietersen.³ The underlying nontechnical causes of the disaster are of a nature that still may be found today, such as economic slump, a shrinking market, competition pressure, cost cuts, an almost endless row of short-staying top managers, downsizing of personnel and a shortage of competent employees, bad maintenance, miscommunication, neglected training of safety and emergency procedures, and a local government not having the strength to maintain a strict policy with respect to industrial safety and environmental protection. Fortunately, over the years our know-how to arrange preventive and protective measures has grown tremendously, and this book wants to demonstrate what has been achieved as well as what methods we can further develop to cope with the complexity of technology and organization. We need goods that industry produces, but ethics require that everything shall be done to prevent harm of employees or the public.

In this chapter, a quick tour d'horizon will be made qualitatively to show the effects of various hazardous phenomena that underlie the risks of processing systems and their products, which we shall encounter in the rest of the book. We give brief examples of disasters caused by some known products that are indispensable to our lives, such as mineral fertilizers, car fuels, and pharmaceuticals. These substances can exhibit nasty properties when brought into certain conditions of dispersal, heat, confinement, and contamination. Of course, industry tries as much as possible to avoid using materials with distinct hazardous properties such as high toxicity and explosiveness/flammability, but lack of better substitutes, and economics, can leave not much choice on practical grounds. Despite the hazardous properties of many materials, the process/chemical industry belongs to one of the safest industrial sectors in the world. The fact that their reputation is often perceived as bad may have much to do with past disasters and that, when rare disasters do happen, they can be on a large scale. In addition, most people are not familiar with the methodology of how hazards can be identified and how well these can be controlled so as to minimize the associated risks. This book aims to contribute to a better understanding of these issues and to indicate ways to make further progress.

This chapter is written particularly for those without the substantial background in chemistry and physics that determines the hazardous potentials of substances, while for specialists it may present a quick overview of the relevant aspects. The hazard potential we will consider is one that may impact over a substantial distance from a source. It can be physical, for example, water in contact with hot, molten metal; it can be a toxic hazard to life in the environment, for example, due to a large spill of crude oil or a radioactive one by an escape of nucleides. The examples we shall describe in this chapter are mostly hazards due to energy release by a chemical (explosive) decomposition or by combustion. Details on properties and mechanisms can be found in an abundance of literature, while for further guidance, many details and references in Lees' Loss Prevention in the Process Industries¹ is recommended. Those who do not need all of the details and may be afraid to lose themselves in 3600 pages can opt for consulting the more modest Lees' Process Safety Essentials.⁴ Note that throughout the book, when process safety is mentioned, it is meant to include plant safety. In the strict sense of the word, process is only the producing mechanism, while plant has the connotation of the area, the premises, where the processes influenced by human and organizational factors take place. In fact, our scope will be even wider because we shall also include the risks of storage and transportation.

The tour starts with the process of nitrogen fixation to form ammonia and the production of ammonium nitrate, which are the basic ingredients of fertilizers without which the world population cannot be fed. Ammonia is a gas, toxic to humans, that can explode when mixed with air; ammonium nitrate is a solid and can explode in all three types of possible, chemically energized explosions. It has produced disastrous accidents after being involved in a fire, being contaminated, or being overheated by other means. Several case histories will be briefly described that will provide insight into the complex phenomena one has to deal with and which will be further explained in Chapter 3. Then we turn to fuels, or rather energy carriers: gasoline, natural gas, liquefied petroleum gas (LPG), and hydrogen. Due to the massive quantities needed to keep the world moving and heated, one after the other of these fuels has been involved in explosions, which may display some similar effects but can also be distinctly different in the way they develop. Next, we shall turn to dust explosions and the many combustible materials that have surprised people with the vigorous way innocent substances such as sugar and sawdust can explode and harm victims. Further, we shall look at pharmaceutical materials and the reactor runaway events that can occur in their preparation and the damage this can cause. Finally, a few recent transportation accidents will be briefly reviewed.

For those who are interested in an historical overview of industrial disasters that have occurred, there are the lists on Wikipedia⁵ and of Abdolhamidzadeh et al.⁶ The latter is focused on 224 domino-effect accidents—when a mishap starts on a small scale but then escalates via surrounding chemicals, process equipment, or neighboring plants. This list provides an overview of cases from various parts of the world and ones with no fatalities but is missing nondomino cases. As part of Marsh Insurance Ltd, Marsh's Risk Consulting Practice publishes compilations of the largest 100 accidents in the hydrocarbon-chemical industry.⁷ As an insurer, Marsh obtains an overview of insured property losses; examples of losses in two sectors over a period from 1971 to 2011 are shown in Chapter 9, Figure 9.1. In Chapter 3 (Section 3.6.2), a number of incident databases are mentioned.

1.1. General global outlook

The world's population has grown numerically, and rapidly, during the last century; this is due in part to the fast-advancing capabilities of medical care. The expectation is that in due time the number of inhabitants on earth will decline; in fact, the growth rate has already fallen to a current value of 1.1% p.a. Nevertheless, between 1990 and 2010 the world population still increased by 30% or in absolute numbers from 5.3 to 6.9 billion. The projection of long-term decline is partly based on the belief that the standard of living in general will increase so that the immediate fear of starving to death in old age, when not looked after by one's progeny, disappears and the necessity to produce a wealth of descendants reduces. The trend of decreasing population growth can clearly be seen in all industrialized countries, even to such an extent that in a number of countries the population is already shrinking. However, there is only one way to raise the standard of living: industrializing and generating the power to drive it all.

Agriculture was of course a solution to mankind when the hunter-scavenger ran out of resources, but with the present size of the earth's population, agriculture without an industrial base would fall very short of being able to feed us all. In fact, our survival is entirely dependent on the process industries. The basic ingredient for artificial fertilizer is ammonia, a compound of the elements nitrogen and hydrogen (NH3), which had been produced on an industrial scale as a side product in coal distillation, the mother of industrial chemistry. As the yield was very limited, other production routes were sought. The solution was direct synthesis from the rather inert gas nitrogen, which makes up about 80% of the air around us, and hydrogen to form ammonia. This reaction is called nitrogen fixation. Part of the ammonia can then be oxidized to nitric acid, with which it is then combined with the remaining ammonia to form ammonium nitrate (AN), the main constituent of mineral fertilizers. The production of pure nitrogen and hydrogen is not that simple, but it will be briefly described later in the chapter. The advent of the industrially produced mineral fertilizers together with a meticulous study of how to successfully grow plants has so far saved us from starvation. According to a United Nations (UN) Food and Agriculture Organization (FAO) publication, today already more than 40% of crops depend on the application of mineral fertilizer and this will increase to more than 80% in the future.⁸ Increases in cereal crop production and the output of mineral fertilizer run in parallel. Organic fertilizers (manure) are less efficient and cannot meet the current demand.

1.2. Ammonium nitrate

On April 17, 2013, a tragedy involving stored AN occurred at the West Fertilizer Company storage and distribution plant in the small town of West, Texas, about 30  km north of the city of Waco; with 15 people killed, 150 injured, and massive destructive damage to the fabric of the town's buildings around the plant. A preliminary investigation by the US Chemical Safety and Hazard Investigation Board⁹ (often just indicated as Chemical Safety Board, abbreviated as CSB) concluded that about 30  tons of ammonium nitrate stored in wooden bins in a wooden warehouse building had detonated after an intense fire, which had broken out in the plant after closing hour. Also stored in the facility were large amounts of anhydrous ammonia and agricultural seeds. No sprinkler system had been installed. The incident led to a Congressional Senate hearing and to much debate about the imperative of compliance with regulatory measures and having sufficient inspection with respect to fertilizer stores throughout the United States.

This was not the first ammonium nitrate explosion and will presumably not be the last one. No informed person could say that no knowledge about the phenomenon existed. It is well known that ammonium nitrate as an oxidizing material must be stored fully separated from combustibles by fire-resistant walls, and certainly not stored in wooden bins. In case of nearby fire, adequate fire protective measures reduce consequences. A presidential US Executive Order was issued on August 1, 2013, entitled Improving Chemical Facility Safety and Security, which called for coordination, communication, and data collection among federal, state, and local agencies to result in actions to assist communities and emergency responders for incident prevention and effective response to chemical incidents. This order will also result in an overhaul of hazardous materials regulation.

Ammonium nitrate's history is as follows. The direct-synthesis ammonia production process was developed by the German scientist Fritz Haber in Karlsruhe and scaled up by process engineer Carl Bosch in Ludwigshafen (BASF) during 1909–1913. The process uses an activated iron-based catalyst and runs at pressures up to 250  bars and at temperatures up to 500  °C. Note that when first invented, much higher synthesis pressures were needed. The development of both more-active catalysts and high-performance centrifugal gas compressors enabled the reduction in synthesis condition to its current value. This is an excellent example of being able to use technology to reduce the magnitude of the hazard (i.e., pressure) and therefore the associated risk. This enables ammonia synthesis to be inherently safer than in earlier times, a concept championed by, amongst others, Trevor Kletz.¹⁰

The reaction to form ammonia is not that fast, and the required reactor residence time is significant as can be imagined from the size of the reactor module shown in Figure 1.1. Part of the raw material therefore had to be recycled after separation of the ammonia as a liquid by cooling under pressure. The construction of such a reactor and its safe operation at the high pressure and temperature mentioned was a significant challenge for the German steel industry. Ammonia can be corrosive, is rather toxic, and moderately explosive when in a certain concentration range if mixed with air. Indeed, the central theme of this book, that of risk control of industrial operations, is already evident with one of the first large-scale synthesis processes. In fact, the German experience in gun barrel manufacture at that time (e.g., with the big Bertha howitzer) certainly had important relevance to the ability to manufacture pressure vessels and piping that could be safely used at very high pressures. The ammonia process needs pure nitrogen. Air separation by cryogenic liquefaction and distillation was developed shortly before this time by Carl von Linde. The liquefaction is achieved as a result of the Joule–Thomson effect when forcing a flow through a restriction, similar as in a home refrigerator or air conditioner. The hazard of pure nitrogen is asphyxiation when entering a space filled with it, and the hazard of pure oxygen is, among others, violent explosion when it comes into contact with combustibles.

Figure 1.1  High-pressure reactor (steel) used for ammonia production following the Haber process. Built in 1921 by Badische Anilin - und Sodafabrik AG in Ludwigshafen am Rhein. Now reerected on the premises of the University of Karlsruhe, Germany, after Wikimedia Commons. ¹¹

The large-scale production of hydrogen, which is required for the process, was another challenge. Because of its small molecular diameter, hydrogen leaks from equipment develop easily and hydrogen mixed with air is very explosive. The original method of using electrolysis to split water into hydrogen and oxygen was too elaborate and uneconomical. But, bringing superheated steam in contact with glowing beds of coke (the water–gas shift reaction process) created a viable new production route. Today, the main source of hydrogen is from natural gas in which the methane (CH4) is stripped of its hydrogen by steam reforming to produce synthesis gas and subsequently applying the water shift reaction. The end products are hydrogen and carbon dioxide, of which the latter aggravates the problem of climate change if not further processed. (It is possible to react carbon dioxide with ammonia to urea, also a fertilizer, although less efficient as fertilizer but inherently much less hazardous.) Later in this chapter, several other methods for the industrial production of hydrogen are mentioned.

Ammonia is applied in fertilizers mainly as ammonium nitrate but also as urea. The nitrate for ammonium nitrate is manufactured by first burning ammonia with air to form nitric oxide. This occurs in the Ostwald process by having the gas briefly contact a platinum catalyst at about 850  °C. In the subsequent cooling, it is further oxidized to nitrogen dioxide and then this is with water and air converted in trickle columns into nitric acid. The latter reacts with ammonia to form ammonium nitrate. Concentrated nitric acid had already been used in the second half of the nineteenth century to produce on an industrial scale nitrocellulose (or more properly named cellulose nitrate), known as gun cotton, and other explosive materials (among others, Alfred Nobel in Sweden). Of course, because of the direct ammonia synthesis process, ammonium nitrate availability was widespread, and as a result, the production of explosives grew tremendously during World Wars I and II. Another side effect was that the industrial production of nitrates put the people in Chile, who dug guano for nitrates, out of work.

Although the production processes described have reached industrial maturity and are now widespread, several disastrous events have occurred due to the properties of their products. Most notorious are the accidents with ammonium nitrate, a substance that can decompose with a surplus of oxygen. Some examples of accidents are described below. Ammonium nitrate (NH4NO3, or for short AN) is called an oxidizing substance. When stored with combustibles it will strongly enhance progression of fire. If ammonium nitrate is heated to its melting point of 170  °C, it decomposes while producing heat and gases. At those temperatures it looks like champagne, an almost colorless bubbling liquid. Gases produced are ammonia, oxidizing nitrogen oxides (nitric acid), water vapor, and the anesthetic nitrous oxide. The latter when mixed with fuels can explode. Because the decomposition is exothermic, once this reaction has started it will sustain itself and usually will accelerate if the heat produced is not effectively removed. This process can result in a so-called thermal explosion.

The decomposition temperature can be greatly decreased if the AN is contaminated with chlorides and/or organics. Decomposition conditions cause certain compound (NPK-) fertilizer mixtures to deflagrate, which has led to incidents in which thousands of tons of stored material were involved. Decomposition and deflagration lead to generation of massive amounts of brownish clouds of toxic gases such as nitrogen oxides, hydrochloric acid, and chlorine. Deflagration is a form of self-sustaining explosive decomposition with a propagating reaction zone, which in a confined space accelerates by pressure buildup and increased heat transfer to the reaction front. A closed pipe filled with deflagrating material will in the end burst due to the high internal pressure that develops. For AN, deflagration can only be stopped by effective cooling with water, which in a large heap of fertilizer is not simple to achieve. In one incident with a deflagration in a ship's hold fully filled with fertilizer, the captain was advised to close the hatches, with the idea that a fire will extinguish when access of oxygen is closed off. Instead, the deflagration accelerated due to enhanced heat transfer to the burning front with the higher pressure. Because one of the reaction products is steam, which then condensed as water, the mass started to become slurry, which as a liquid cargo led to instability and capsizing of the ship in the middle of the Atlantic Ocean. Following various such decomposition incidents, the industry now tries to avoid formulations that are able to deflagrate.

The third type of explosion that ammonium nitrate can produce is detonation. The AN in a slightly porous form is even used as an explosive, but in that case it is usually mixed with a fuel such as diesel oil, in which case it is called ANFO. Detonation can either be initiated by a strong shock wave generated by a high explosive booster charge or by a weaker shock that is applied over a large surface area. In unintended, accidental explosions it is the latter that typically occurs. The first major AN disaster was in 1921 at the site of the production plant in Oppau near Ludwigshafen, Germany. The explosion was initiated by explosive charges deliberately set to loosen up the 4500-ton caked, hygroscopic 50/50 mixture of ammonium sulfate and AN fertilizer in a storage tower. The practice was justified after conducting detonation tests with the mixture in tubes in which detonation could not be initiated. However, due to a locally, slightly richer composition in AN, and the uncertainty margin in the test, part of the stored fertilizer detonated, with enormous consequences. Based on damage assessment, an estimated 10% of the total quantity detonated. A satisfactory understanding of the failure of the test emerged only in the 1970s, when much more knowledge about the phenomenon of detonation existed, in particular about how difficult it is to extrapolate from the behavior of a small-scale test sample to thousands of tons of ammonium nitrate. As a result of the Oppau accident, more than 500 people died and 2000 were injured, adjacent buildings were destroyed with damage occurring to the windows and roofs (i.e., the weakest elements) of structures many kilometers away (see Figure 1.2).

A second detonation disaster occurred at the harbor site of Texas City, Texas, USA, on April 16, 1947, when a fire broke out on board a ship filled with 2300  tons of ammonium nitrate fertilizer. This time, blast and fragments from the ship explosion killed 581 people and caused many domino effects to nearby ships and shore installations. The blast also initiated a fire in an adjacent moored ship, also loaded with ammonium nitrate fertilizer, but with a smaller cargo of about 1000  tons. This second ship exploded 15  h after the first one. Ten years later, American and European experts tried in vain with field experiments on Helgoland (part of the German archipelago in the North Sea) to reproduce the phenomenon of an ammonium nitrate fire-to-detonation transition. Notwithstanding this failure, the phenomenon has since reoccurred in several accidents.

Figure 1.2  Picture of the crater and the destruction caused by the explosion of an ammonium nitrate–ammonium sulfate mixture on September 21, 1921 at the BASF plant in Oppau near Ludwigshafen, Germany. Taken from Wikipedia.

In the 1960s, the Organisation for Economic Co-operation and Development (OECD) set up an International Group on Unstable Substances (IGUS), which amongst other groups started to investigate the hazardous properties of ammonium nitrate. In the years following in various OECD countries, much work has been carried out. For example, in laboratory and field tests, the relationship between thickness of steel wall in a tube test of sufficient length versus the mass effect of an unconfined heap of substance was determined. This resulted, for example, in a European Union (EU)-prescribed tube test and more stringent regulations for production and, in particular, for storage and transport of AN. The industry adapted their formulations such that the probability of deflagration and detonation could be reduced to almost zero. At the same time, they tried to retain the fertilizing properties of AN essentially unchanged. This resulted in the production of nearly pure, prilled (pelletized) ammonium nitrate. If the small, hard spherical prills possess a high density, that is, with no sensitizing air bubble inclusions or cracks, this cannot be detonated. Lower density prills, however, are of detonation grade. A problem is that due to the crystal modification transition at 32  °C and the corresponding small change in density, an originally high-density prill following a few temperature cycles may degrade. The IGUS group is still active in the entire field of hazardous substances. It supports the UN ECOSOC's Committee of Experts on Transport of Dangerous Goods and the Committee on the Globally Harmonized System of Classification and Labeling of Chemicals with respect to technical aspects of tests and criteria.

A third large AN disaster took place in Toulouse, France, in a fertilizer plant on September 21, 2001; this disaster has some similarities with the Oppau event and was exactly 80  years later! Again, a large crater formed, see Figure 1.3, which caused 21 fatalities and injured thousands of people. The initiation of the event, however, was completely different. In a storage facility containing about 300  tons of fertilizer, some off-specification product was collected that somehow was contaminated with sodium dichloroisocyanurate, used as a disinfectant in water purification. This substance contains the element chlorine and an organic component; hence, as mentioned before, it had exactly the right ingredients to initiate self-heating of ammonium nitrate at lower-than-normal temperatures, possibly resulting in fast decomposition and subsequently in detonation with an estimated TNT equivalent of 20–40  tons.¹³ A full-scale experiment to reproduce what could have occurred was unsuccessful despite quite intensive research. We still do not fully understand the precise conditions at which ammonium nitrate becomes highly dangerous. The accident had a large impact on French regulations with respect to major hazard industries. Prior to the accident, when determining safe separation distances, the French competent authority had limited itself to consequence considerations. After the accident, it embarked on full-fledged risk analysis with consideration also of occurrence probability, a procedure earlier adopted by, for example, the United Kingdom, the Netherlands, and Scandinavian countries. In later chapters, we shall introduce a more detailed overview of some attractive aspects that were introduced in the French approach to risk assessment.

Figure 1.3  Crater after the ammonium nitrate detonation at the Toulouse AZF plant on September 21, 2001. The estimated explosion strength was up to 40   tons of trinitro toluene (TNT) equivalent. ¹²

The stories about ammonium nitrate are somewhat typical for developments in general. Knowledge about the properties of chemicals has been growing over the years and can be found, for example, in Material Safety Data Sheets (MSDSs), while the founding of the Globally Harmonized System (GHS) of Classification and Labelling of Chemicals, to be discussed in Chapter 2, is a step in the direction of great progress. Although many details, and sometimes important details, remain to be revealed, safeguards against undesirable events have been incorporated into regulation, codes and standards, and best practices. But because of a variety of reasons that we shall elaborate in Chapter 4, these safeguards are not always, nor uniformly, applied. Note that the common deficiencies in knowledge include detailed insight into the mechanism and data for the complex exothermic chemical decomposition kinetics. At this time, except for combustion kinetics of hydrocarbons, important in gas explosions, one must rely on various kinds of heat and mass loss tests to determine overall kinetics characterized by reaction order, activation energy, and rate constants. This makes prediction by means of computer model simulation of the behavior of hazardous substances in various situations uncertain because most initiations, fast as in shock, by spark, friction, or impact, or slow as in self-heating, is thermal by nature. Self-heating can be the result of the material itself (the material is then designated as a self-reactive chemical) stored at too high temperature or because it comes into contact with another substance with which it is not compatible. Self-heating starts slowly but accelerates due to temperature increase. Because most reaction rates increase exponentially with temperature, the decomposition rate can achieve a high value quickly (exothermic or thermal explosion). Initially, acceleration may be due to small amounts of decomposition products accumulating, which is called auto-catalysis, or by the substance losing its crystal structure. The time to explosion is called the induction period, and the process is named runaway. The sensitivity and precision of the thermal tests needed to characterize such behavior has improved tremendously over the years. The same can be said of the equipment for analytical chemistry, yet this progress has not been sufficient to enable us to answer all the questions needed before we can make accurate predictions of thermal decomposition behavior. In Chapter 3, we shall further discuss the topic. Nevertheless, despite tens of events in the past, accidents continue to occur. On September 7, 2014, in Queensland, Australia, a truck carrying 50  tons of AN fertilizer rolled over. Fire broke out, likely due to igniting (diesel) fuel, and the load detonated, disintegrating the truck.

1.3. Ammonia

Anhydrous ammonia, as we have seen, is a starting material for the production of ammonium nitrate; it can also be used as a fertilizer by injecting it directly into the ground, a practice common in North America. Another application is as the recirculating fluid in refrigeration systems, about which many spill incidents are reported despite guidelines for proper use. Its hazard characteristics differ markedly from those of ammonium nitrate, and it is therefore worth considering here as another example. As mentioned before, apart from being moderately explosive when mixed with air, ammonia is toxic. At normal ambient conditions, it is a gas. To store it in large quantities, it is either liquefied under pressure (about 10  bar at 25  °C) or is refrigerated (boiling point –33  °C). It can be contained in tanks of carbon steel or CrNi(Mo) steel. Stress corrosion can be avoided by a small addition of water (0.1–0.2%). Ammonia spill hazards are often underestimated, but they have resulted in a considerable number of casualties.

Despite all safety measures, loss of containment can occur as happened in the incident in Potchefstroom, South Africa, in 1973 where a horizontal cylindrical tank released 38 metric tons of anhydrous ammonia.¹⁴ Upon catastrophic rupture of a tank and release, the ammonia will be spilled partly as vapor and partly as a boiling liquid, which will spread over the ground whilst evaporating. The vapor is visible as a white cloud by absorption of, and reaction with, the moisture in the air. Initially the cloud is cold and heavy, but gradually, while dispersing and drifting with the wind, it heats up and becomes buoyant. For the dispersion of gas clouds, computational models have been developed about which some brief observations will be made in Chapter 3. In the case of Potchefstroom, the tank cracked and a hole was formed from which mainly vapor escaped. Because of the release, 18 people died, of whom four resided in a nearby area at a distance of 150–200  m, and 65 workers needed medical treatment. The toxic properties of ammonia are expressed as a probability distribution of lethality versus concentration inhaled over time or dose. This takes the form of a probit function, which is a transformed cumulative normal distribution presented as a straight line running from 1 to 99% lethality, depending on the vulnerability condition of the exposed people. The probit function is determined by three parameters as shown in the equation:

(1.1)

the exposure time. One can imagine that it is not an easy task to determine these coefficient values for humans. Data sources are derived from animal experiments, medical considerations, and analysis of actual accidents.

The official Dutch ammonia probit figures predicted originally in 1992 (Green Book¹⁵) a 50% probability of lethality at 30  min exposure (LC50) of roughly 5.4  g/m³ air volume. In 2012, it was proposed¹⁶ to modify these figures to reduce the analogous dose to about 1.8  g/m³. Probit relations are also used to express extent of harm to people by heat and blast, as we shall see in Chapter 3. The evidence that can be extracted from an actual incident is very uncertain because there are source uncertainties, which have to be modeled for the dispersion, and there are strong cloud concentration fluctuations, which are not modeled. Furthermore, people will try to flee from the cloud, so the exposure times are very different and may tend to be short. In addition, there are local obstacles or partly sealed enclosures, which may provide some protection. Hence, even when the initial population density at various distances from the source can be estimated, counting victims does not provide data that can be used for accurate probit validation. We shall come back to this type of uncertainty when discussing the reliability of risk analysis figures in Chapter 3.

The release in Potchefstroom involved hot work on the tank but with the omission of any stress relief thereafter. Good maintenance on ammonia tanks remains a matter of continuous attention. Accidents keep on occurring. At the time of writing this text,¹⁷ a leak at a chemical plant in eastern Ukraine released ammonia causing the deaths of at least five people and injuring 20.

1.4. Petrochemicals

In the foregoing discussion, we focused on large-scale mineral fertilizer production as the world depends on this. It is just one example; the energy industry is another. And, can we live without fuels and synthetic materials derived from the petrochemical industry, such as plastics in all kinds of applications, fibers, coatings, adhesives, lubricants, and so on? No answer is needed to this rhetorical question as is clear when considering the large amounts of plastic waste produced, spilling over in the oceans' plastic soup. Feed stock for the petrochemical industry is mostly oil and gas. These raw materials must be made more reactive to enable further processing. The two main routes are cracking the hydrocarbons at elevated temperature and collecting the unsaturated smaller molecules such as ethylene (C2-chain) and propylene (C3), and/or partially oxidizing the hydrocarbon. An example of a substance produced when in succession both cracking/distillation and oxidizing are carried out is ethylene oxide (EO, also called oxirane), which itself is used again as the starting material for a large variety of products. The boiling point of EO is 11  °C, and it is usually stored as a liquid under pressure in rust-free carbon steel tanks. Its usefulness is extensive, because it can react with the addition of many other substances. It also dimerizes and polymerizes; it can be reduced and further oxidized, all yielding different products from cosmetics and antifreeze to sterilizers. However, the material safety data sheet of ethylene oxide looks quite frightful. The gas is toxic at a concentration below where you can first smell it; when mixed with air the mixture is flammable, hence explosive, from 3% ethylene oxide in air to 100%. In other words, due to the presence of an oxygen atom in the molecule, an explosion propagates in the pure substance. This property makes it even suitable for applications such as a fuel–air explosive that makes it a dreadful blast weapon. In particular, in the 1980s and 1990s, there were serious accidents with EO, but given the properties and the amounts that are handled, its record is relatively safe, thanks to many effective preventive risk-reducing measures.

1.5. Gasoline

If an arbitrary person would be asked whether gasoline, the car fuel, is a hazardous substance, nine answers out of 10 would probably state it is a flammable material but not particularly hazardous. Yet, in the GHS of dangerous substances (see Chapter 2, Section 2.7), its constituents are classified with the following hazard statements: (highly) flammable, toxic when swallowed, and may cause cancer. In the last few years, there have been a number of very violent explosions of vapor clouds formed in the open air after a storage tank overfilled and a massive amount of gasoline was spilled. The first of these incidents was at the Buncefield Oil Storage Depot, Hemel Hempstead, Hertfordshire, near London, UK, on the early morning of Sunday, December 11, 2005. The depot was an important hub in the fuel distribution for cars, trucks, and aircraft. The spillage had taken place during the night. It was rather cold; there was an atmospheric inversion layer and almost no wind. A huge, dense, white cloud spread over the premises as recorded on CCTV security cameras. The cloud eventually came into contact with an ignition source and exploded. The devastation was enormous both on the premises and at off-site offices and general-purpose buildings (Figure 1.4).

By pure luck and thanks to the time of the incident, nobody was seriously injured, but had it been during daytime on a normal weekday this would have been a large disaster with many victims. Due to the explosion, fire spread to 10 or more large fuel tanks, see Figure 1.5. It took days to extinguish the fires; there was a great deal of air pollution from the smoke and the soil was polluted by runoff firewater containing hydrocarbons and firefighting foam ingredients. Luckily, later the nearby aquifer did not seem to be seriously damaged. A broad investigation board was set up and an impressive investigation effort made. Much has been written about this incident and the final report¹⁸ was published in 2008. Chapters 4, 5 and 6 will discuss nontechnical causes of accidents as also present in this case. Here, we shall describe a few physical aspects of the vapor cloud explosion as an illustration of the hazards that potentially form a threat and that should motivate plant management to implement tight risk controls. Indeed, since the Buncefield disaster, the worldwide focus on the safety integrity of overfill protection systems has deservedly enjoyed more attention. In fact, over the years at different places similar accidents had occurred.

Figure 1.4  Damage at off-site buildings and to parked cars neighboring the west side of the Buncefield complex showing the blast severity. From the Buncefield final report.¹⁸

Figure 1.5  View of the destroyed storage tanks. From the Buncefield final report.¹⁸

Unconfined vapor cloud explosions, as they were originally named, became recognized as a phenomenon deserving research attention in the late 1960s and early 1970s when several occurred in the scaled-up plants of that time, for example, the notorious 1974 one at the Nypro plant near Flixborough, UK (see Lees¹). From the start, there was international cooperation on the subject, but despite many balloon experiments in which explosive gas mixtures were ignited, no blast was observed unless the ignition was initiated by the detonation of a high explosive charge. This conundrum remained until a link was made with the results of experiments with deflagrating explosive gas mixtures in pipes, closed at one end and ignited at the closed end. In such experiments acceleration of the flame was observed due to turbulence by friction with the wall of the unburned gas, pushed out ahead of the developing flame. Such acceleration was associated with the buildup of pressure and, in a later stage, shock waves in the pipe. These effects possibly even generated a transition of the deflagration into a detonation given a pipe that was long enough. When the tube wall was provided with metal objects intruding into the gas space, hence amplifying drag resistance to the flowing gas (thus simulating congestion) and generating even more turbulence, the effect was much stronger. TNO in the Netherlands then conducted experiments first on a small scale¹⁹ and later on a large scale in open space with arrays of vertical pillars with central ignition.²⁰ The latter tests took place with propane-air on Dow Chemical Co. premises at Mosselbanken near Terneuzen in 1982 (Figure 1.6).

During the next 20  years, with European collaboration and with EU sponsorship, one test series after another such as MERGE and EMERGE were performed and a new theory developed. The initial motivation for the sponsorship was derived from a nuclear safety program: reactors built next to rivers should be protected against vapor cloud explosions due to spills of flammables resulting from possible tanker ship collision on the river. As a result of the growing understanding, the addition unconfined in the original name of unconfined vapor cloud explosion disappeared. The theory resulted in simplified models such as TNO's Multi-Energy Method and Computational Fluid Dynamics codes such as FLACS from the Norwegian company Gexcon. Although explosion strength